448 lines
15 KiB
Nginx Configuration File
448 lines
15 KiB
Nginx Configuration File
user root;
|
||
worker_processes auto;
|
||
|
||
events {
|
||
worker_connections 8192;
|
||
use epoll;
|
||
multi_accept on;
|
||
}
|
||
|
||
http {
|
||
include mime.types;
|
||
default_type application/octet-stream;
|
||
charset utf-8;
|
||
|
||
sendfile on;
|
||
tcp_nopush on;
|
||
tcp_nodelay on;
|
||
keepalive_timeout 65;
|
||
types_hash_max_size 2048;
|
||
server_tokens off;
|
||
|
||
# 全局 gzip
|
||
gzip on;
|
||
gzip_vary on;
|
||
gzip_min_length 1024;
|
||
gzip_proxied any;
|
||
gzip_comp_level 6;
|
||
gzip_types
|
||
text/plain
|
||
text/css
|
||
text/js
|
||
text/xml
|
||
text/javascript
|
||
application/javascript
|
||
application/xml+rss
|
||
application/json
|
||
image/svg+xml;
|
||
|
||
# =========================
|
||
# ZKXW 管理端（测试环境 8112）
|
||
# 静态目录: /root/zkxw/dist
|
||
# API 反代: 47.99.164.66:8112
|
||
# =========================
|
||
server {
|
||
listen 8112;
|
||
listen [::]:8112;
|
||
server_name 47.121.120.79 localhost 127.0.0.1;
|
||
|
||
root /root/zkxw/dist;
|
||
index index.html;
|
||
|
||
client_max_body_size 100M;
|
||
|
||
access_log /var/log/nginx/zkxw_admin_8112_access.log;
|
||
error_log /var/log/nginx/zkxw_admin_8112_error.log;
|
||
|
||
# 健康检查 / Swagger（须在 location / 之前；否则 /health 会走 SPA 返回 index.html）
|
||
location = /health {
|
||
proxy_pass http://47.99.164.66:8112/health;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_connect_timeout 10s;
|
||
proxy_read_timeout 30s;
|
||
}
|
||
|
||
location ^~ /docs {
|
||
proxy_pass http://47.99.164.66:8112;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
}
|
||
|
||
location = /openapi.json {
|
||
proxy_pass http://47.99.164.66:8112/openapi.json;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
}
|
||
|
||
# API -> 测试后端（47.99.164.66:8112）
|
||
location ^~ /api/ {
|
||
proxy_pass http://47.99.164.66:8112;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_connect_timeout 10s;
|
||
proxy_send_timeout 120s;
|
||
proxy_read_timeout 120s;
|
||
}
|
||
|
||
# MinIO 附件直链（bucket=zkxw；端口与后端 MINIO_ENDPOINT 映射一致，默认 20003）
|
||
location ^~ /minio/zkxw/ {
|
||
proxy_pass http://47.99.164.66:20003/zkxw/;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $http_host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_request_buffering off;
|
||
proxy_buffering off;
|
||
proxy_read_timeout 600s;
|
||
proxy_send_timeout 600s;
|
||
proxy_connect_timeout 10s;
|
||
|
||
add_header Access-Control-Allow-Origin * always;
|
||
add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
|
||
add_header Access-Control-Allow-Headers "DNT,User-Agent,Keep-Alive,Content-Type,Authorization,Range,If-Modified-Since,Cache-Control" always;
|
||
|
||
if ($request_method = OPTIONS) {
|
||
add_header Content-Length 0;
|
||
add_header Content-Type text/plain;
|
||
return 204;
|
||
}
|
||
}
|
||
|
||
# SPA 路由（放最后，避免吞掉 /health、/api 等）
|
||
location / {
|
||
try_files $uri $uri/ /index.html;
|
||
}
|
||
|
||
# 静态资源缓存
|
||
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
|
||
expires 30d;
|
||
add_header Cache-Control "public, immutable" always;
|
||
add_header X-Content-Type-Options nosniff always;
|
||
access_log off;
|
||
}
|
||
|
||
# HTML 禁缓存，便于发版后立刻生效
|
||
location ~* \.html$ {
|
||
add_header Cache-Control "no-cache, no-store, must-revalidate" always;
|
||
add_header Pragma "no-cache" always;
|
||
add_header Expires "0" always;
|
||
}
|
||
|
||
# 禁止访问隐藏文件
|
||
location ~ /\. {
|
||
deny all;
|
||
access_log off;
|
||
log_not_found off;
|
||
}
|
||
}
|
||
# =========================
|
||
# SQXP Admin 静态服务（本机 3006）
|
||
# =========================
|
||
server {
|
||
listen 3006;
|
||
listen [::]:3006;
|
||
server_name 127.0.0.1 localhost 47.121.120.79;
|
||
|
||
root /root/sqxp-dist/dist;
|
||
index index.html;
|
||
|
||
access_log /var/log/nginx/sqxp_admin_3006_access.log;
|
||
error_log /var/log/nginx/sqxp_admin_3006_error.log;
|
||
|
||
# SPA 路由支持
|
||
location / {
|
||
try_files $uri $uri/ /index.html;
|
||
}
|
||
|
||
# 静态资源缓存
|
||
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
|
||
expires 30d;
|
||
add_header Cache-Control "public, immutable" always;
|
||
add_header X-Content-Type-Options nosniff always;
|
||
access_log off;
|
||
}
|
||
|
||
# HTML 禁缓存，便于发版后立刻生效
|
||
location ~* \.html$ {
|
||
add_header Cache-Control "no-cache, no-store, must-revalidate" always;
|
||
add_header Pragma "no-cache" always;
|
||
add_header Expires "0" always;
|
||
}
|
||
|
||
# 禁止访问隐藏文件
|
||
location ~ /\. {
|
||
deny all;
|
||
access_log off;
|
||
log_not_found off;
|
||
}
|
||
}
|
||
|
||
# =========================
|
||
# 主站：https://www.chengyantek.cn
|
||
# =========================
|
||
server {
|
||
listen 443 ssl http2;
|
||
listen [::]:443 ssl http2;
|
||
server_name www.chengyantek.cn;
|
||
|
||
ssl_certificate "/root/cert/www.chengyantek.cn.pem";
|
||
ssl_certificate_key "/root/cert/www.chengyantek.cn.key";
|
||
|
||
ssl_session_cache shared:SSL:10m;
|
||
ssl_session_timeout 1h;
|
||
ssl_protocols TLSv1.2 TLSv1.3;
|
||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||
ssl_prefer_server_ciphers on;
|
||
|
||
access_log /var/log/nginx/ahchengyan_access.log;
|
||
error_log /var/log/nginx/ahchengyan_error.log;
|
||
|
||
client_max_body_size 100M;
|
||
|
||
# =========================
|
||
# SQXP Admin 外部访问入口
|
||
# =========================
|
||
location ^~ /sqxp-admin/ {
|
||
proxy_pass http://127.0.0.1:3006/;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_connect_timeout 10s;
|
||
proxy_send_timeout 60s;
|
||
proxy_read_timeout 60s;
|
||
}
|
||
|
||
# =========================
|
||
# SQXP API 同域代理 -> 47.99.164.66:8000/api
|
||
# 前端请求 /sqxp-api/web/... -> 后端 /api/web/...
|
||
# =========================
|
||
location ^~ /sqxp-api/ {
|
||
proxy_pass http://47.99.164.66:8000/api/;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_connect_timeout 10s;
|
||
proxy_send_timeout 60s;
|
||
proxy_read_timeout 60s;
|
||
}
|
||
|
||
# 直接把 bucket 路径代理到 MinIO（bucket= sanqiang）
|
||
location ^~ /sanqiang/ {
|
||
proxy_pass http://127.0.0.1:20004/sanqiang/;
|
||
proxy_http_version 1.1;
|
||
|
||
proxy_set_header Host $http_host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto https;
|
||
|
||
proxy_request_buffering off;
|
||
proxy_buffering off;
|
||
proxy_read_timeout 600s;
|
||
proxy_send_timeout 600s;
|
||
proxy_connect_timeout 10s;
|
||
}
|
||
|
||
# ===== MinIO 直链访问（新增，推荐）=====
|
||
location ^~ /minio/ {
|
||
proxy_pass http://127.0.0.1:20004/;
|
||
proxy_http_version 1.1;
|
||
|
||
proxy_set_header Host $http_host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto https;
|
||
|
||
proxy_request_buffering off;
|
||
proxy_buffering off;
|
||
proxy_read_timeout 600s;
|
||
proxy_send_timeout 600s;
|
||
proxy_connect_timeout 10s;
|
||
|
||
add_header Access-Control-Allow-Origin * always;
|
||
add_header Access-Control-Allow-Methods "GET, PUT, POST, DELETE, HEAD, OPTIONS" always;
|
||
add_header Access-Control-Allow-Headers "Authorization,Content-Type,Content-Length,Content-MD5,Date,ETag,Range,X-Amz-Date,X-Amz-Conte
|
||
nt-Sha256,X-Amz-Security-Token,X-Amz-User-Agent" always;
|
||
add_header Access-Control-Expose-Headers "ETag,Content-Length,Content-Range,Accept-Ranges,x-amz-request-id,x-amz-id-2" always;
|
||
|
||
if ($request_method = OPTIONS) {
|
||
add_header Content-Length 0;
|
||
add_header Content-Type text/plain;
|
||
return 204;
|
||
}
|
||
}
|
||
|
||
# ===== 小程序静态资源 =====
|
||
location ^~ /sqxp-static/ {
|
||
alias /root/sqxp/;
|
||
access_log off;
|
||
|
||
if ($request_method = OPTIONS) {
|
||
add_header Access-Control-Allow-Origin * always;
|
||
add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
|
||
add_header Access-Control-Allow-Headers "DNT,User-Agent,Keep-Alive,Content-Type,Authorization,Range,If-Modified-Since,Cache-Contr
|
||
ol" always;
|
||
add_header Access-Control-Max-Age 86400 always;
|
||
add_header Content-Length 0;
|
||
add_header Content-Type text/plain;
|
||
return 204;
|
||
}
|
||
|
||
add_header Access-Control-Allow-Origin * always;
|
||
add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
|
||
add_header Access-Control-Allow-Headers "DNT,User-Agent,Keep-Alive,Content-Type,Authorization,Range,If-Modified-Since,Cache-Control"
|
||
always;
|
||
|
||
expires 30d;
|
||
add_header Cache-Control "public";
|
||
add_header Vary "Accept-Encoding";
|
||
|
||
try_files $uri =404;
|
||
}
|
||
|
||
# favicon
|
||
location = /favicon.ico {
|
||
root /root/Lyrria/frontend/dist;
|
||
access_log off;
|
||
log_not_found off;
|
||
expires 1y;
|
||
add_header Cache-Control "public, immutable";
|
||
}
|
||
|
||
# robots
|
||
location = /robots.txt {
|
||
access_log off;
|
||
log_not_found off;
|
||
return 200 "User-agent: *\nDisallow:\n";
|
||
}
|
||
|
||
# WebSocket 代理
|
||
location /ws {
|
||
proxy_pass http://127.0.0.1:8766;
|
||
proxy_http_version 1.1;
|
||
proxy_set_header Upgrade $http_upgrade;
|
||
proxy_set_header Connection "upgrade";
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_read_timeout 3600s;
|
||
proxy_send_timeout 3600s;
|
||
proxy_connect_timeout 10s;
|
||
}
|
||
|
||
# API 代理（Lyrria）
|
||
location ^~ /api/ {
|
||
proxy_pass http://127.0.0.1:8766$request_uri;
|
||
proxy_set_header Host $host;
|
||
proxy_set_header X-Real-IP $remote_addr;
|
||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
proxy_set_header X-Forwarded-Proto $scheme;
|
||
proxy_read_timeout 60s;
|
||
proxy_send_timeout 60s;
|
||
proxy_connect_timeout 10s;
|
||
}
|
||
|
||
# 主站静态资源缓存（Lyrria）
|
||
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
|
||
root /root/Lyrria/frontend/dist;
|
||
expires 30d;
|
||
add_header Cache-Control "public, immutable" always;
|
||
add_header X-Content-Type-Options nosniff always;
|
||
}
|
||
|
||
# SPA 路由支持（Lyrria）
|
||
location / {
|
||
root /root/Lyrria/frontend/dist;
|
||
index index.html;
|
||
try_files $uri $uri/ /index.html;
|
||
|
||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||
add_header X-Content-Type-Options "nosniff" always;
|
||
add_header X-XSS-Protection "1; mode=block" always;
|
||
}
|
||
|
||
# HTML 不缓存
|
||
location ~* \.html$ {
|
||
root /root/Lyrria/frontend/dist;
|
||
add_header Cache-Control "no-cache, no-store, must-revalidate" always;
|
||
add_header Pragma "no-cache" always;
|
||
add_header Expires "0" always;
|
||
try_files $uri =404;
|
||
}
|
||
|
||
# 禁止访问隐藏文件
|
||
location ~ /\. {
|
||
deny all;
|
||
access_log off;
|
||
log_not_found off;
|
||
}
|
||
|
||
location ~ ~$ {
|
||
deny all;
|
||
access_log off;
|
||
log_not_found off;
|
||
}
|
||
}
|
||
|
||
# 非www在443跳转到www
|
||
server {
|
||
listen 443 ssl http2;
|
||
listen [::]:443 ssl http2;
|
||
server_name chengyantek.cn;
|
||
|
||
ssl_certificate "/root/cert/www.chengyantek.cn.pem";
|
||
ssl_certificate_key "/root/cert/www.chengyantek.cn.key";
|
||
|
||
return 301 https://www.chengyantek.cn$request_uri;
|
||
}
|
||
|
||
# =========================
|
||
# 未来如果给 img.chengyantek.cn 单独申请好证书，再加这个 server
|
||
# =========================
|
||
# server {
|
||
# listen 443 ssl http2;
|
||
# listen [::]:443 ssl http2;
|
||
# server_name img.chengyantek.cn;
|
||
#
|
||
# ssl_certificate "/root/.acme.sh/img.chengyantek.cn_ecc/fullchain.cer";
|
||
# ssl_certificate_key "/root/.acme.sh/img.chengyantek.cn_ecc/img.chengyantek.cn.key";
|
||
#
|
||
# ssl_session_cache shared:SSL:10m;
|
||
# ssl_session_timeout 1h;
|
||
# ssl_protocols TLSv1.2 TLSv1.3;
|
||
# ssl_ciphers HIGH:!aNULL:!MD5;
|
||
# ssl_prefer_server_ciphers on;
|
||
#
|
||
# access_log /var/log/nginx/minio_img_access.log;
|
||
# error_log /var/log/nginx/minio_img_error.log;
|
||
#
|
||
# client_max_body_size 100M;
|
||
#
|
||
# location / {
|
||
# proxy_pass http://127.0.0.1:20004;
|
||
# proxy_http_version 1.1;
|
||
# proxy_set_header Host $http_host;
|
||
# proxy_set_header X-Real-IP $remote_addr;
|
||
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||
# proxy_set_header X-Forwarded-Proto https;
|
||
# proxy_request_buffering off;
|
||
# proxy_buffering off;
|
||
# proxy_read_timeout 600s;
|
||
# proxy_send_timeout 600s;
|
||
# proxy_connect_timeout 10s;
|
||
# }
|
||
# }
|
||
} |